CVE-2026-108101
Deferred Deferred - Pending Action

Unauthenticated File Upload in HortusFox Web Application

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: VulnCheck

Description
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-108101
EUVD
EUVD-2026-95792

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
danielbrendel hortusfox-web 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HortusFox through version 6.3 has an unrestricted file upload flaw in the PlantAttachmentModel component. Authenticated users can upload files with any extension to the public/attachments/ directory. This allows attackers to upload malicious files like HTML, SVG, or PHP files if .htaccess restrictions are not enforced.

Detection Guidance

Check for unexpected files in the public/attachments/ directory of HortusFox installations. Look for files with unusual extensions like .html, .svg, or .php. Inspect server logs for POST requests to /plants/attachments/add with file uploads.

Impact Analysis

An attacker could upload a malicious file that executes arbitrary code on the server if PHP files are not restricted. Alternatively, they could inject malicious scripts via HTML or SVG files to perform cross-site scripting attacks against other users visiting the site.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Restrict file uploads to specific safe extensions. Disable execution permissions for uploaded files in the attachments directory. Implement strict input validation for file uploads. Ensure .htaccess enforces execution restrictions if PHP files are allowed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108101. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart